Systems and methods for automatically generating malware countermeasures

A system comprising:

• a virtual machine running an operating system, the virtual machine configured to run a sample comprising a malware;
• a monitoring subsystem running on the virtual machine and configured to generate event data based on a plurality of events occurring on the virtual machine;
• a classifier configured to detect the malware based on the plurality of events;
• and
• a countermeasure compiler configured to compile an analysis log file including the event data to generate a countermeasure to the malware.

A non-transitory computer readable medium storing computer readable instructions, that when executed on one or more processors, implements a method comprising:

• running a virtual machine with an operating system configured with a monitoring subsystem, the monitoring subsystem configured to generate event data based on a plurality of events occurring on the virtual machine;
• running a classifier configured to detect a malware based on the plurality of events;
• running a sample on the virtual machine, the classifier detecting the malware in the sample;
• and
• running a countermeasure compiler that generates a countermeasure to the malware, the countermeasure based on the event data.